MALICIOUS — 21be500fbc0be8d461630f2ed17324d39468ee536290851c2077dd54a9badf7b

MALICIOUS — 21be500fbc0be8d461630f2ed17324d39468ee536290851c2077dd54a9badf7b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100). 5 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 21be500fbc0be8d461630f2ed17324d39468ee536290851c2077dd54a9badf7b
• SHA-1: efe724e282d67250668593dcc53fab8b15d8a370
• MD5: cfd491ad5f29ba2f69f3e073c4e60789
• imphash: 9ffc59d97fa7bc95242d6970ebf528e1
• ssdeep: 6144:GzLxdgY9ODU7xr5Kd2IdJi0QFk5PIOpby8D:S1xmUlrKdgdk5wEbyK
• TLSH: T1BB45799028FDACE8C198B3883A55E01DA55FF91F6B799828D6C5BF5814D2D73C04086F
• Submitted as: 21be500fbc0be8d461630f2ed17324d39468ee536290851c2077dd54a9badf7b
• File type: pe · Size: 269352 bytes
• Verdict: malicious (97/100)

Detections (5 of 55 engines)

• ClamAV (daily): Win.Trojan.Agent-1373867
• Microsoft Defender: Trojan:Win32/Emotet.KDS!MTB
• Emsisoft (Emergency Kit): Trojan.GenericKDZ.96038
• Trellix Stinger (McAfee): Packed-AM!CFD491AD5F29
• Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

• T1112
• T1105

Why this verdict

The malicious score of 97/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Agent-1373867 (rule Win.Trojan.Agent-1373867) - engine signal, weight 0.90, confidence 0.95
• Memory forensics: 6 finding(s), e.g. process hollowing in pythonw.exe (pid 3144) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.70, confidence 0.85
• Contacted 18 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
• Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

2551 behavior events · 1 ATT&CK techniques · 6 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• ctldl.windowsupdate.com
• login.live.com
• ocsp.digicert.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• oneocsp.microsoft.com
• www.msn.com
• officeclient.microsoft.com

Dropped files

• C:\ProgramData\Mozilla\erxzllk.exe - b7b43523aed996d52aa3afd9905b28d7523e536c948ec8f6ef51863f2b15984c
• C:\ProgramData\Mozilla\ydxarvb.dll - 6ab97d0b0db00f129468528b4cadc1fe70733444cf6d6acd388f54c80474f0a7
• ac1d5c7930bce06f390cd75b8264ac8a0dd9a2a8790b848bd0eb82bda0ccdefb - ac1d5c7930bce06f390cd75b8264ac8a0dd9a2a8790b848bd0eb82bda0ccdefb
• 455aa53bf88aab9e65f2f226aa2c588002b109f9c7f72acadf8d9b99934d1608 - 455aa53bf88aab9e65f2f226aa2c588002b109f9c7f72acadf8d9b99934d1608
• 7c10555b2d6575cbd9ee9bf60f1f8c9810eadd5112a14883500d6bf293e1632a - 7c10555b2d6575cbd9ee9bf60f1f8c9810eadd5112a14883500d6bf293e1632a
• d7676cf069c41bbe709207dbb388b0d7ba128d07ad5b2692e17ee26217edf4c9 - d7676cf069c41bbe709207dbb388b0d7ba128d07ad5b2692e17ee26217edf4c9

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787916372&P2=404&P3=2&P4=EZvp5TVSLNYwbIlq%2bpLdYqKAOEmzcyYpV8NbsGFJpQaDoF7%2b%2biBhl%2bmc11%2bi0MhRJcEty0wvKnmZQGmTkkiJQQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787916464&P2=404&P3=2&P4=STTHN4izYwniBQtBtHyut97yKhUQe%2bZ97H4Nxopb%2fkmlWVG4KV1Ee06QVpetDUvK0fwPQQ6BdpnmARAMmIy6CQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

• 13.89.179.15
• 4.230.171.124
• 4.247.188.224
• 4.144.132.223
• 74.178.76.128
• 20.184.175.4
• 74.179.77.164
• 52.123.129.14
• 52.123.128.14
• 20.236.44.162
• 162.159.142.9
• 20.184.175.13
• 172.178.240.163
• 203.26.79.13
• 52.148.114.188
• 135.233.95.80
• 72.145.35.102
• 52.110.12.38

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report